Enhancing Cybersecurity in DNP3-Based Smart Grids: An Adaptive Hybrid Artificial Immune System Approach for Anomaly Detection

The increasing integration of communication protocols like DNP3 within Smart Grid Supervisory Control and Data Acquisition (SCADA) systems enhances operational efficiency but concurrently introduces significant cybersecurity vulnerabilities. Addressing the limitations of traditional signature-based and basic anomaly detection methods, this paper proposes an adaptive hybrid Artificial Immune System (AIS) for robust anomaly detection in DNP3 environments. The approach enhances the segmented Deterministic Dendritic Cell Algorithm (S-dDCA) by incorporating signal decomposition via the Maximal Overlap Discrete Wavelet Transform (MODWT) for improved signal processing and utilizes Decision Trees for classification. A key contribution is an adaptive two-tier detection architecture comprising a rapid primary analysis stage and a targeted, computationally intensive secondary stage for suspicious instances, optimizing both detection accuracy and resource utilization. Evaluated using the comprehensive ITHACA DNP3 Intrusion Detection Dataset, the proposed system demonstrated exceptional performance, achieving 99.68% accuracy, 99.56% precision, 99.98% sensitivity, and 98.95% specificity. The results highlight the effectiveness of the hierarchical, immune-inspired approach in significantly reducing false positives while maintaining high detection rates, offering a promising solution for enhancing the cybersecurity posture of DNP3-based critical infrastructure.